Hermes AI Agent Runs Unattended in Cyberattack on Thai Finance Ministry

Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry

Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection. The agent then worked through the ministry's network on its own, checking hosts for ways to gain root access, hunting through file systems, and crawling a folder of staff personnel records going back to 2012. The operator left the agent's own logs sitting on a web server with directory listing switched on, where threat intelligence firm Hunt.io and researcher Bob Diachenko found them, along with 585 files and 470 MB of attack tooling. The tool is Hermes, an open-source assistant from Nous Research that people install to manage their mail, run chores, and take instructions over Telegram or Slack. It is not a hacking tool, and nothing here is a flaw in it. The mode the operator used, called YOLO, is a documented feature with its own command-line flag. That is what separates this case from the AI-assisted attacks reported so far. When Anthropic disclosed a Chinese group using Claude Code for espionage last November, the attackers had to trick the model into cooperating, and Anthropic banned their accounts once it noticed. Hermes runs on the operator's own machine. No vendor was watching, and there was no account to ban. The operator was already inside before the agent started. Hunt.io recovered a hidden web shell planted on a ministry web server, scripts written against named internal Hadoop systems, and stolen mailbox passwords hardcoded into a mail-testing script. Nothing in the recovered files shows data leaving the network, and how the operator first got in is unknown. Thailand's national CERT and cybersecurity agency were notified on July 15; neither had published anything when The Hacker News checked on July 24. For everyone else, the useful detail is what the operator's scripts were built to exploit: a Hadoop database service that ships accepting any password by default. The human did the parts that require knowing the target. Hunt.io's writeup shows a password list built from the ministry's own department abbreviations rather than a dictionary, and shellcode carrying hardcoded paths into the ministry intranet. The agent did the repetitive part: run a scan, read the output, decide what to check next, run another. Nothing in the recovered material shows it finding a new vulnerability or choosing the target. None of the commands were exotic. LinPEAS, a standard script that hunts for privilege escalation paths on Linux. A search for files carrying elevated permissions. A directory crawl. A person would type the same things. What changed is that nobody had to approve each one. Hermes offers that setting three ways: a --yolo flag at launch, a /yolo command mid-session, or a HERMES_YOLO_MODE=1 environment variable. The project's configuration guide says to "only use this in trusted, sandboxed environments." One layer survives it: a hardline blocklist that still refuses commands which would wipe the machine the agent is running on. What the operator switched off was the human check, not every safeguard. What the agent did Five files named call_00_*.txt hold the agent's turns: kernel vulnerability scanning against a ministry host, a second LinPEAS run, a sweep for elevated-permission binaries, a filesystem listing, and a recursive crawl of the web root belonging to the Office of the Permanent Secretary. That folder held Office documents, performance evaluations, and personnel records dating to 2012. The logs show the agent reading the directory. None of them show the files leaving it. The scan script it was handed was not stock. A customized linpeas.sh checked for four 2026 Linux kernel flaws across three families: Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and DirtyClone (CVE-2026-43503). Each hands a local user root where its prerequisites hold, which for Dirty Frag and DirtyClone means CAP_NET_ADMIN. All were weeks old when the operator staged them, and nothing recovered names a ministry kernel version or shows that any of the four ran. The operator's own SSH session into the staging server came from 103.97.0[.]57 in Hong Kong. The agent's web interface password contains the Chinese word Leishen, thunder god, and a key for FOFA, a Chinese asset-search service, sits alongside it. The same server previously hosted a ShadowPad controller and now runs a VShell command-and-control listener. Hunt.io assesses with low-to-medium confidence that the operator is Chinese-speaking or fluent in the language, and names no group. The firm and Diachenko remain the only public source for the ministry-specific findings. The route into Hadoop Most of the custom code went on the ministry's Hadoop cluster, where it stores and queries large volumes of data. A script called hive_rce_py2.py connects to HiveServer2, the SQL front end to that cluster, on an internal machine at port 10000, and sends a password. Apache's own documentation says the default authentication mode is NONE, which accepts whatever password it is given without checking it. Once connected, the script installs a malicious Java add-on called HiveCmd.jar as a user-defined function, which lets it run operating-system commands through ordinary database queries and read the results back. Cloudera warns that anyone able to install such a function can run arbitrary code as the Hive service account and reach sensitive data. Also staged on the server: a previously undocumented Go implant the operator calls Hades, built for both Windows and Linux in 62 copies. Hunt.io analyzed one of each and found the same codebase; the other 60 were not examined individually. Their hardcoded addresses tie the staging server to a second Hong Kong host, though no recovered artifact shows Hades reaching a ministry machine. Separate scripts tested default credentials against an internal GlassFish console, with neither deployment confirmed, alongside exploit code for three older flaws in polkit, sudo, and IIS 6.0. What to do * Check whether HiveServer2 is running with authentication set to NONE, and restrict who can install user-defined functions. That default is what the operator's script was written to rely on. * Alert when a web server process opens a connection to internal Hadoop ports such as 10000 or 50070. A web server reaching a Hadoop node is worth a look on its own. * Search web roots recursively for PHP files with leading-dot names that imitate system caches. This one sat at /storage/Counter/nine/.journald-cache.php and does not appear in a normal directory listing. * Patch kernels against all four 2026 flaws above, plus sudo to 1.9.5p2 or later, polkit for CVE-2021-4034, and any remaining IIS 6.0 WebDAV. The agent leaves its own trail. Hermes's web panel returns a HermesWebUI server header, and a search on that string returned roughly 5,900 scan events over a month, as of Hunt.io's July 23 report, counting sightings rather than distinct machines. The better hook is where the agent writes its results: a consistent /hermes-results/ folder with predictable filenames, which turned up 575 hits in Hunt.io's index of exposed directories the same day, each one a host and filename pair. No safety control exposed this operator. A directory listing did. The endpoint sees the same shell commands and the same tools either way. Nothing in an ordinary command line announces that nobody is at the keyboard.

Hermes AI agent used to automate attack on Thai Finance Ministry

A threat actor used the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation activity during an alleged breach of Thailand's Ministry of Finance. The activity was uncovered by threat intelligence company Hunt.io and security researcher Bob Diachenko after they discovered several exposed web directories containing hundreds of files associated with the operation. Hunt.io says session files, deployed web shells, and evidence of access to internal systems indicate that the attackers compromised multiple systems within the ministry's network. However, the Ministry of Finance has not confirmed that its systems were breached, and some of the recovered artifacts only show that particular systems were targeted rather than successfully compromised. BleepingComputer contacted Thailand's Ministry of Finance and ThaiCERT to confirm the reported attack and will update this story if we receive a response. Attack infrastructure exposed online Between July 9 and July 13, Hunt.io discovered three simultaneously exposed directories on a server hosted in Hong Kong. The directories contained 585 files totaling approximately 470 MB, including exploit code, web shells, HTTP tunneling tools, custom scripts, stolen credentials, compiled payloads, and logs generated by the Hermes AI agent. The recovered files referenced Ministry of Finance systems by name, hostname, and internal IP address, and included scripts targeting internal services. Some scripts targeted the ministry's Hadoop infrastructure, Apache Ambari management platform, GlassFish administrative console, and an administrative web panel. Other scripts tested authentication against ministry mail servers using hardcoded email addresses and passwords. Hunt.io also found a PHP web shell that it says had been deployed on a Ministry of Finance web server. The researchers linked the initial server to additional attacker-controlled infrastructure by shared TLS certificates used during the same time period. "In addition to the common name, all these certificates share a JA4X fingerprint, a hash derived from the structure of the certificate itself rather than its contents," explained Hunt's report. "Querying that hash alongside the www common name in HuntSQL returned two additional, related hosts: 118.107.222[.]232 (The Gigabit, Malaysia) and 202.181.27[.]115 (Converged Communications Limited, Hong Kong)." One of those servers was later linked to the operation through a command-and-control address embedded in a recovered implant. The directories also contained Windows and Linux builds of a previously undocumented Go-based implant that the operator called Hades. However, the more interesting discovery was a collection of logs showing that the attackers used an AI agent, Hermes, to automate parts of the cyberattack against the ministry. Hermes operating in YOLO mode Hermes is an open-source AI agent released in February 2026 that runs as a persistent service and can remember information between different task sessions. The AI agent can interact with tools and execute commands while working on tasks provided by the operator. The software includes a setting known as YOLO mode, which removes prompts that would require a person to approve dangerous commands. The researchers were able to recover environment information and Hermes output logs from the exposed directories that showed the operator had enabled this unattended mode. This allowed the agent to execute commands and continue analyzing systems without waiting for human approval at each step. Five recovered Hermes call logs show the agent was used to find a way to elevate privileges, scan for kernel vulnerabilities, enumerate services, search for SUID and SGID binaries, inspect containers, and traverse file systems. Hermes was also told to use a customized version of the LinPEAS privilege-escalation enumeration script to collect information from a Ministry of Finance host. In another task, the operator instructed Hermes to recursively search a web directory associated with the Office of Permanent Secretary for Finance. The agent cataloged PDF, DOC, and XLS files, including performance assessments and personnel records dating back to 2012. However, Hunt says it found no evidence that these files were exfiltrated. The findings do not indicate that Hermes independently decided to target the ministry. Instead, the exposed logs show an operator supplying the agent with objectives and tooling while YOLO mode allowed it to carry out routine post-exploitation commands without constant supervision. Hunt.io says the recovered artifacts depict an active intrusion in which tools had been staged and access to internal systems was expanding. However, the researchers could not determine how the attackers initially gained access. The company and Diachenko notified ThaiCERT and Thailand's National Cyber Security Agency on July 15. According to the report, both organizations acknowledged receiving the notification that day. This Hermes activity is the latest example of autonomous AI agents being used to conduct cyberattacks. Earlier this month, the JadePuffer ransomware operation used an AI agent to automate an entire intrusion, including reconnaissance, credential theft, lateral movement, privilege escalation, and data encryption. Autonomous agents can also cause real-world breaches, even if unintentional. OpenAI recently disclosed that its models autonomously hacked Hugging Face while undergoing cybersecurity benchmark testing, exploiting zero-day vulnerabilities to escape a sandboxed testing environment and access the internet. It then used stolen credentials and additional vulnerabilities to breach Hugging Face's production systems.